Skip to content

Commit be40643

Browse files
amir73ilgregkh
authored andcommitted
ovl: fix access beyond unterminated strings
commit 601350f upstream. KASAN detected slab-out-of-bounds access in printk from overlayfs, because string format used %*s instead of %.*s. > BUG: KASAN: slab-out-of-bounds in string+0x298/0x2d0 lib/vsprintf.c:604 > Read of size 1 at addr ffff8801c36c66ba by task syz-executor2/27811 > > CPU: 0 PID: 27811 Comm: syz-executor2 Not tainted 4.19.0-rc5+ #36 ... > printk+0xa7/0xcf kernel/printk/printk.c:1996 > ovl_lookup_index.cold.15+0xe8/0x1f8 fs/overlayfs/namei.c:689 Reported-by: [email protected] Signed-off-by: Amir Goldstein <[email protected]> Signed-off-by: Miklos Szeredi <[email protected]> Fixes: 359f392 ("ovl: lookup index entry for copy up origin") Cc: <[email protected]> # v4.13 Signed-off-by: Greg Kroah-Hartman <[email protected]>
1 parent aa41fb9 commit be40643

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

fs/overlayfs/namei.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -519,7 +519,7 @@ static struct dentry *ovl_lookup_index(struct dentry *dentry,
519519
index = NULL;
520520
goto out;
521521
}
522-
pr_warn_ratelimited("overlayfs: failed inode index lookup (ino=%lu, key=%*s, err=%i);\n"
522+
pr_warn_ratelimited("overlayfs: failed inode index lookup (ino=%lu, key=%.*s, err=%i);\n"
523523
"overlayfs: mount with '-o index=off' to disable inodes index.\n",
524524
d_inode(origin)->i_ino, name.len, name.name,
525525
err);

0 commit comments

Comments
 (0)